Subject: Re: syslogd oddities
To: Daniel Brown <dbrown@ccdc.cam.ac.uk>
From: matthew green <mrg@eterna.com.au>
List: port-sparc
Date: 07/09/1998 21:36:20
   I've been busily setting up a NetBSD 1.3.2/sparc box as a syslogging host, and
   have had a fair amount of success in doing so.

cool.
   
   However, I've noticed that on random, infrequent occasions, syslogd just stops
   logging messages delivered via udp from other (Solaris) hosts, but keeps
   on logging messages generated locally (presumably via /dev/*log).
   
   You can watch the packets arriving via tcpdump, but no logging occurs.
   Restarting syslogd restores normal behaviour.
   
   I was wondering if this was a known problem, and if so, wherein lies the cure?

i've never heard of this problem so i don't know the cure :(
   
   P.S. I'm running with a faintly modified syslogd, that always logs time
   stamps, and a slightly modified newsyslog, that allows execution of log
   digesting scripts on logs in the process of being rotated. However -
   none of this should affect the receiving/logging of messages...


this could be it  :)


can you do this:
	- run ktrace on the syslogd to find out what is it doing...
	- use fstat (or lsof if you have that installed) to find out
	  what fd/inode syslogd is writing too/reading from..

does syslogd recvfrom() packets ?  does the inode being written
correspond to the inode of the log file?  (ie, have you somehow
gotten syslogd writting to a file that has been renamed, or deleted?)


.mrg.